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1 The following are all the claims as they stand after this response. Please amend claims 1 

2 and 23. 
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1. [amended] A met|tiod for classifying a data packet, the 
method comprising: 



receiving the dat^ 
classification tree; 



packet at a root node of a 



successively passing the data packet to each child of a 
first tree level lanfcil a first child of the first tree level 
of the classif icatjjon tree indicates a satisfaction of a 
node-criteria packet raatchinq fiinction of said first child, 
and the first chiip forming said data packet into a matched 
packet ; and 
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repeating the feteps of passing and forming for a next 
tree level until/ no first child of said next level at a 
succeeding next /level indicates satisfaction of the 
node-criteria lofacket matching function of said first child 
of said next level , 



18 2. A method /as 

19 passing inclujaes 

20 status indicdtic 



icited in claim 1, wherein the step of 
cecuting a set of code which returns a 



21 3, A methdd/as recited in claim 1, wherein the step of 

22 forming incisMes the first child specifying a set^of code to 

23 be run subsequently. 
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4. A method as recited id claim 3, wherein the step of 
specifying includes specifying the set of code to be run 
following satisfaction. 



4 
5 
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5. A method as recited in claim 1, further comprising ally 
adding at least one nojSe in at least one level of the 
classification tree. 



7 6. A method as reci^ted in claim 5, wherein said at least 

8 one new child node ik a Real Audio node. 
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7. A method for olassifying a packet, said method 
comprising suspending a packet classification process in 
progress for said/packet; and obtaining external information 
employed in said /classifying. 



13 8. A method iA claim 7, wherein the step of obtaining 

14 includes augmeiiting a node-criteria of a node in a 

15 classificatior/ tree with external information. 



16 
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9. A method as in claim 8, wherein the external 
information ^ncludes identification of the originator of 
said packet, 



19 
20 
21 



10. A method as in claim 8, wherein the external 
informatiojfi includes authentication of an originator of said 
packet . 



22 
23 



11. A mefbhod as recited in claim 7, wherein the 
classifictation process is an extendible classifier process, 
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12. A method as recifced in claim 1, further comprising the 
step of parsing sai^ matched packet and generating relevant 
information. 



4 13. A method as ±-ecited in claim 1, further comprising the 

5 step of trans forrfting said matched packet into a transformed 

6 packet - 

7 14. A method ds recited in claim 1, further comprising 

8 associating th^ packet with a last first child indicating 

9 satisfaction. 

10 15, A method as recited in claim 14, further comprising 

11 executing a iet of code in accordance with said last first 

12 child. 

13 16. A methdd as recited in claim 1, further comprising 

14 determining/a disposition of the data packet. 

15 17 . A metriod for determining disposition of a packet 

16 received at a child node, said method comprising: 

17 passing said packet and a first disposition of said packet 

18 to an external process; and 

19 said external process augmenting the packet disposition by 

20 employing a process specific means; and returning the 

21 augmented packet and an augmented disposition to the child 

22 node . 



23 
24 
25 



18. ^method as recited in claim 11, further comprising 
susperlding a disposition process in progress for said 
pack€ 
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1 19- A method as in claim 18, wherein the augmented 

2 disposition includes identification of an originator of said 

3 packet . 

4 20, A method as in c:laim 18 wherein the augmented 

5 disposition includes authentication of an originator of said 

6 packet , 



7 
8 
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21. A method as recited in claim 18, wherein the 
disposition is employed for policy enforcement. 

22. A method as recited in claim 16, further comprising 



employing the class i 



ication process as a firewall. 
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23. [amended] A method as recited in claim 1, further 
coirprising enrployinb the classification process for dynamic 
application level cclassif ication. 

24. A method as recited in claim 23, further comprising 
employing the clatssif ication process for policy enforcement, 

25. A method afe recited in claim 23, further comprising 
employing the classification process for rate limiting. 

26. A method^ as recited in claim 23, further comprising 
employing th^ classification process for load balancing. 

27. A method as recited in claim l, further comprising 
employing t/ie classification process to shape traffic . 



22 
23 



28. An apparatus to classify a data packet, the apparatus 
comprising 
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1 a network interface dev^cG to receive the data packet 

2 from the physical network /and pass the data packet to the 

3 root node of a classification tree, and the reverse, to 

4 receive the data packet from the root node and send the data 

5 packet to the physical network; 

6 a packet module to successively pass the packet from 

7 child node to child node kt a next tree level until a first 

8 child node of the next triee level of the classification tree 

9 which indicates a satisfaction of a node-criteria of the 

10 first child node, and td form the data packet into a matched 

11 packet until no first child node of at a succeeding next 

12 level indicates satisfaction of the first node-criteria of 

13 the first child node of the succeeding next level. 

14 29- An apparatus as ±ecited in claim 28, wherein a portion 

15 of the apparatus is iirrplemented as an accelerator chip. 

16 30, An apparatus as/ recited in claim 28, wherein the 

17 apparatus is employefd for application level classification. 

18 31- An apparatus afs recited in claim 28, wherein the 

19 apparatus / 

20 is employed as a nirewall, 

21 32. An apparatus/ as recited in claim 28, wherein the 

22 apparatus is employed as a border server. 

23 33- A method b/s recited in claim 2, wherein the status 

24 indication is if the pm_t type. 

25 34. An article of manufacture comprising a computer usable 

26 medium having/ computer readable program code means embodied 
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1 therein for causing classification of a data packet, the 

2 computer readable program codfe means in said article of 

3 manufacture comprising compu/er readable program code means 

4 for causing a coir5>uter to effect the steps of claim 1. 

5 35. An article of manufactfure as recited in claim 34, the 

6 computer readable program ybode means in said article of 

7 manufacture further comprising computer readable program 

8 code means for causing a /computer to effect ally adding at 

9 least one node in at leafet one level of the classification 

10 tree. / 

11 36. An article of manftifacture comprising a conqputer usable 

12 medium having computet readable program code means embodied 

13 therein for causing (fclassif ication of a data packet, the 

14 con5)uter readable program code means in said article of 

15 manufacture comprising computer readable program code means 

16 for causing a computer to effect the steps of claim 8. 

17 37. A computer ntogram product comprising a computer usable 

18 medium having coittputer readable program code means embodied 

19 therein for caua(ing a determination of a disposition of a 

20 packet, the cornfe>uter readable program code means in said 

21 computer program product comprising computer readable 

22 program code cfteans for causing a computer to effect the 

23 steps of claim 18. 

24 38. An apparatus for classifying a data packet, the 

25 apparatus ootnprising: 

26 means f/or receiving the data packet at a root node of a 

27 classification tree; 
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means for successively parsing the data packet to each 
child of a first tree level/ until a first child node of the 
first tree level of the classification tree indicates a 
satisfaction of a node-criteria of said first child node, 
and the first child node /forming said data packet into a 
matched packet; and 



7 
8 
9 
10 
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means for repeating /the steps of passing and forming for 
a next tree level unti/l no first child node of said next 
tree level at a succeeding next level indicates satisfaction 
of the node-criteria/ of said first child node of said 
succeeding next level. 



12 
13 



39. An apparatus tor determining disposition of a packet 
received at a child node, said apparatus comprising: 



14 an interrupt context of a control program, said child node 

15 existing within /the interrupt context; 

16 an external process outside of the interrupt context of the 

17 control program; 



IS 
19 
20 
21 
22 



means for passing said packet and a first disposition of 
said packet tfo the external process, said external process 
to augment the packet disposition by employing a process 
specific meajhLs and to return an augmented packet with an 
augmented di/sposition to the child node; and 



23 
24 
25 



said interrupt context including means for receiving said 
augmented A^acket and said augmented disposition from said 
external process . 
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